Detect frameworks by looking at packages in composer.lock, which makes for more reliable detection, also when the framework package is not directly required in the project's composer.json